Can someone who discovered a zero-day exploit in a program sell the information, and does the applicable jurisdiction depend on his location, the buyer location, the location of the developed of the product that the exploit targets, or something else?
It might possibly be illegal.
For criminal law, usually you need to obey the laws of three countries:
- The country you are a national of (by personality principle)
- The country from where you make the sale (by territoriality principle)
- The country that hosts the attacked interest (by territoriality principle)
Then it depends on the jurisdiction (and other factors) whether the sale is legal or not. I'll use the example of my country, Czech Republic.
There is a crime called "Unauthorized access to a computer system or data storage device". For example, you commit this crime by exploiting a vulnerability in a web application and copying the web owner's data on your computer.
It is also codified that whoever wilfully facilitates the committing of a crime by providing the criminal with resources (such as the exploit) is considered to have also committed the crime. For this to apply, you must have known or expected that the exploit will be used to commit a crime. The courts would decide this.